A Right based framework, Without direct right to compensation ?

In law we have a well-known maxim called “ubi jus ibi remedium”, which means where there is a right, there is a remedy.

If an act provides various rights but fails to provide right to compensation, if fails and exists only on paper. 

The DPDP act, which got its presidential assent on 11 August 2023, provides various rights to data principal such as right to access, correct, update, erase, and nominate. But it doesn’t have a standalone right to compensation.

The act made headlines for the huge and deterrent penalties it imposes, which go upto 250 crore, and straight away go to consolidated fund of India. 

But essentially penalties and compenasationare different in nature. 

➢ Penalty is imposed to ensure accountability and is in deterrent nature

➢ Compensation is redress given for the harm suffered.

Think-up, if a company's data breach exposes an individual's personal information, imposing a penalty may hold the company accountable.

But it does not, by itself, restore the individual's loss or compensate them for the consequences they experienced.

So, the question is not whether organisations should be penalised.

They should. The question is whether penalising the organisation is sufficient when an individual has also suffered harm.

➢ GDPR approach

European Union GDPR Article 82 expressly provides individuals with a right to compensation for material and non-material damage resulting from an infringement.

The GDPR therefore distinguishes between two consequences of a violation:

• Regulatory enforcement — holding the organisation accountable and deterring future violations.

• Compensation — providing redress to the individual who suffered damage.

The DPDP Act provides for the first, but does not contain an equivalent standalone compensation provision.

A penalty may protect the system.

But compensation addresses the individual needs. 

As India's data protection framework develops, this is a question worth asking:

If the Data Principal is at the centre of the DPDP Act, should the individual also have a direct and meaningful avenue for compensation when their privacy rights are violated?

Because ultimately, the strength of a rights-based framework may depend not only on the rights it recognises, but also on the remedies it makes available when those rights are breached.